Add optional external checkout inputs to docker-build-publish workflow

.github/workflows/docker-build-publish.yml

@@ -10,6 +10,35 @@ on:
         required: true
         type: string
 
+      checkout_repo:
+        description: >
+          Optional external repo to checkout (owner/name). If set, repo is checked out
+          into checkout_path.
+        required: false
+        type: string
+        default: ""
+
+      checkout_ref:
+        description: >
+          Optional git ref (branch/tag/SHA) for checkout_repo. Defaults to repo default branch.
+        required: false
+        type: string
+        default: ""
+
+      checkout_path:
+        description: >
+          Path to checkout checkout_repo into.
+        required: false
+        type: string
+        default: "external-src"
+
+      checkout_fetch_depth:
+        description: >
+          Fetch depth for checkout_repo (0 = full history).
+        required: false
+        type: string
+        default: "0"
+
       registry_host:
         required: true
         type: string
@@ -53,6 +82,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Checkout external repository
+        if: ${{ inputs.checkout_repo != '' }}
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ inputs.checkout_repo }}
+          ref: ${{ inputs.checkout_ref }}
+          server-url: ${{ github.server_url }}
+          token: ${{ secrets.ci_token }}
+          path: ${{ inputs.checkout_path }}
+          fetch-depth: ${{ inputs.checkout_fetch_depth }}
+
       - name: Load env vars
         if: ${{ inputs.env != '' }}
         run: |

.github/workflows/node-ci.yml

@@ -21,6 +21,9 @@ on:
         required: false
         type: string
         default: ""
+      install_command:
+        type: string
+        default: "pnpm install --frozen-lockfile"
       format_command:
         type: string
         default: "pnpm format:check"
@@ -33,6 +36,9 @@ on:
       test_command:
         type: string
         default: "pnpm test"
+      build_command:
+        type: string
+        default: ""
     secrets:
       ssh_private_key:
         required: false
@@ -99,7 +105,8 @@ jobs:
             ${{ runner.os }}-pnpm-
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        if: ${{ inputs.install_command != '' }}
+        run: ${{ inputs.install_command }}
         working-directory: ${{ inputs.working_directory }}
 
       - name: Run format check
@@ -121,3 +128,8 @@ jobs:
         if: ${{ inputs.test_command != '' }}
         run: ${{ inputs.test_command }}
         working-directory: ${{ inputs.working_directory }}
+
+      - name: Run build
+        if: ${{ inputs.build_command != '' }}
+        run: ${{ inputs.build_command }}
+        working-directory: ${{ inputs.working_directory }}

.github/workflows/python-uv-ci-with-db.yml

@@ -21,6 +21,12 @@ on:
         required: false
         type: string
         default: ""
+      test_env:
+        description: >
+          Multiline env vars for tests, one per line: KEY=VALUE
+        required: false
+        type: string
+        default: ""
       uv_sync_args:
         type: string
         default: "--frozen --dev"
@@ -36,6 +42,48 @@ on:
       test_command:
         type: string
         default: "uv run pytest"
+      alembic_command:
+        type: string
+        default: ""
+      postgres_image:
+        type: string
+        default: "postgres:16"
+      postgres_user:
+        type: string
+        default: "postgres"
+      postgres_password:
+        type: string
+        default: "postgres"
+      postgres_db:
+        type: string
+        default: "test_db"
+      postgres_health_cmd:
+        type: string
+        default: "pg_isready -U postgres"
+      postgres_health_interval:
+        type: string
+        default: "10s"
+      postgres_health_timeout:
+        type: string
+        default: "5s"
+      postgres_health_retries:
+        type: string
+        default: "5"
+      redis_image:
+        type: string
+        default: "redis:7-alpine"
+      redis_health_cmd:
+        type: string
+        default: "redis-cli ping"
+      redis_health_interval:
+        type: string
+        default: "5s"
+      redis_health_timeout:
+        type: string
+        default: "5s"
+      redis_health_retries:
+        type: string
+        default: "20"
     secrets:
       ssh_private_key:
         required: false
@@ -47,18 +95,25 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:16
+        image: ${{ inputs.postgres_image }}
         env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: test_db
+          POSTGRES_USER: ${{ inputs.postgres_user }}
+          POSTGRES_PASSWORD: ${{ inputs.postgres_password }}
+          POSTGRES_DB: ${{ inputs.postgres_db }}
         ports:
           - 5432:5432
         options: >-
-          --health-cmd="pg_isready -U postgres"
-          --health-interval=10s
-          --health-timeout=5s
-          --health-retries=5
+          --health-cmd="${{ inputs.postgres_health_cmd }}"
+          --health-interval=${{ inputs.postgres_health_interval }}
+          --health-timeout=${{ inputs.postgres_health_timeout }}
+          --health-retries=${{ inputs.postgres_health_retries }}
+      redis:
+        image: ${{ inputs.redis_image }}
+        options: >-
+          --health-cmd="${{ inputs.redis_health_cmd }}"
+          --health-interval=${{ inputs.redis_health_interval }}
+          --health-timeout=${{ inputs.redis_health_timeout }}
+          --health-retries=${{ inputs.redis_health_retries }}
     permissions:
       contents: read
     defaults:
@@ -121,6 +176,19 @@ jobs:
       - name: Sync dependencies
         run: uv sync ${{ inputs.uv_sync_args }}
 
+      - name: Load test env vars
+        if: ${{ inputs.test_env != '' }}
+        run: |
+          while IFS= read -r line; do
+            [ -z "$line" ] && continue
+            case "$line" in \#*) continue;; esac
+            if [[ "$line" != *=* ]]; then
+              echo "Invalid env line: $line" >&2
+              exit 1
+            fi
+            echo "$line" >> "$GITHUB_ENV"
+          done <<< "${{ inputs.test_env }}"
+
       - name: Run format check
         if: ${{ inputs.format_command != '' }}
         run: ${{ inputs.format_command }}
@@ -133,6 +201,10 @@ jobs:
         if: ${{ inputs.typecheck_command != '' }}
         run: ${{ inputs.typecheck_command }}
 
+      - name: Alembic upgrade head (smoke test)
+        if: ${{ inputs.alembic_command != '' }}
+        run: ${{ inputs.alembic_command }}
+
       - name: Run tests
         if: ${{ inputs.test_command != '' }}
         run: ${{ inputs.test_command }}